3

I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I imagine that other candidates will perform a similar task, but is it a good idea?

5
  • 5
    Define "good idea"
    – schroeder
    Jun 22, 2018 at 15:09
  • 1
    Testing a live company website as part of an interview process is illegal in the United States, even if they gave you permission. They cannot request free, unpaid work. Run away FAST if they are trying to get you to perform free penetration tests. Jun 22, 2018 at 16:55
  • Maybe they don't expect you to find anything, but just want to see your methodology. Jun 22, 2018 at 17:10
  • @multithr3at3d Doesn't matter. This basically becomes "free consultation work" during an interview. If they wanted to see his methodology, they need to set up an environment in which to test this methodology. Jun 22, 2018 at 17:29
  • Yeah, you guys raise good points. Thanks for the input! Jun 22, 2018 at 20:09

1 Answer 1

3

A lot of companies are giving challenges as part of the interview process these days, mostly on sample apps, I've never heard of testing on a live site as part of an interview.

Do you have a paper trail? Is there an email from someone at a high level approving of this? If not I'd ask for an email from someone at the director level or higher that indicates you have permission. Then agree on a time and have everything in writing.

Are they looking for a free pen test? Maybe, but oh man is that shady if true.

2
  • 1
    Unpaid consultation during a job interview can be illegal in many places. This is not good advice even if they sign off on it because the company may be trying to obtain work for nothing. It doesn’t take long to set up an exploitable web application or server, and there are many free services such as HackTheBox, so I highly recommend either moving on or saying no. Jun 22, 2018 at 17:38
  • There's an email trail, nothing on paper - which is another thing that makes me skeptical besides it being a live site and sort of free work. Anyway, I concluded that I won't go ahead if it's not a dedicated test environment that is not related to anything they want to or already have deployed. Thanks 😁 Jun 22, 2018 at 20:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .